|
| 1 | +# iMessage Media Parser Zero-Click → CoreAudio RCE → PAC/RPAC → Kernel → CryptoTokenKit Abuse |
| 2 | + |
| 3 | +{{#include ../../banners/hacktricks-training.md}} |
| 4 | + |
| 5 | +This page summarizes a modern iOS zero-click attack surface and an observed end-to-end exploitation chain abusing iMessage automatic media parsing to compromise CoreAudio, bypass BlastDoor, defeat Pointer Authentication (PAC) via an RPAC path, escalate to kernel, and finally abuse CryptoTokenKit for unauthorized key uses. |
| 6 | + |
| 7 | +> Warning: This is an educational summary to help defenders, researchers, and red teams understand the techniques. Do not use offensively. |
| 8 | +
|
| 9 | +## High-level chain |
| 10 | + |
| 11 | +- Delivery vector: a malicious audio attachment (e.g., .amr / MP4 AAC) sent via iMessage/SMS. |
| 12 | +- Auto-ingestion: iOS auto-parses media for previews and conversions without user interaction. |
| 13 | +- Parser bug: malformed structures hit CoreAudio’s AudioConverterService and corrupt heap memory. |
| 14 | +- Code exec in media context: RCE inside the media parsing process; reported to bypass BlastDoor isolation in specific paths (e.g., “known sender” framing path). |
| 15 | +- PAC/RPAC bypass: once arbitrary R/W is achieved, a PAC bypass in the RPAC path enables stable control flow under arm64e PAC. |
| 16 | +- Kernel escalation: the chain converts userland exec into kernel exec (e.g., via wireless/AppleBCMWLAN code paths and AMPDU handling as seen in logs below). |
| 17 | +- Post-exploitation: with kernel, abuse CryptoTokenKit to perform signing with Secure Enclave–backed keys, read sensitive data paths (Keychain contexts), intercept messages/2FA, silently authorize actions, and enable stealth surveillance (mic/camera/GPS) without prompts. |
| 18 | + |
| 19 | +## iMessage/BlastDoor attack surface notes |
| 20 | + |
| 21 | +BlastDoor is a hardened service designed to parse untrusted message content. However, observed logs indicate paths where protections may be bypassed when messages are framed from a “known sender” and when additional filters (e.g., Blackhole) are relaxed: |
| 22 | + |
| 23 | +```text |
| 24 | +IDSDaemon BlastDoor: Disabled for framing messages |
| 25 | +SpamFilter Blackhole disabled; user has disabled filtering unknown senders. |
| 26 | +``` |
| 27 | + |
| 28 | +Takeaways: |
| 29 | +- Auto-parsing still represents a remote, zero-click attack surface. |
| 30 | +- Policy/context decisions (known sender, filtering state) can materially change the effective isolation. |
| 31 | + |
| 32 | +## CoreAudio: AudioConverterService heap corruption (userland RCE) |
| 33 | + |
| 34 | +Affected component: |
| 35 | +- CoreAudio → AudioConverterService → AAC/AMR/MP4 parsing and conversion flows |
| 36 | + |
| 37 | +Observed parser touchpoint (logs): |
| 38 | + |
| 39 | +```text |
| 40 | +AudioConverterService ACMP4AACBaseDecoder.cpp: inMagicCookie=0x0, inMagicCookieByteSize=39 |
| 41 | +``` |
| 42 | + |
| 43 | +Technique summary: |
| 44 | +- Malformed container/codec metadata (e.g., invalid/short/NULL magic cookie) causes a memory corruption during decode setup. |
| 45 | +- Triggers in the iMessage media conversion path without taps by the user. |
| 46 | +- Yields code execution in the media parsing process. The write-up claims this escapes BlastDoor in the observed delivery path, enabling the next stage. |
| 47 | + |
| 48 | +Practical tips: |
| 49 | +- Fuzz AAC/AMR magic cookie and MP4 codec atoms when targeting AudioConverterService conversions. |
| 50 | +- Focus on heap overflows/underflows, OOB reads/writes, and size/length confusion around decoder initialization. |
| 51 | + |
| 52 | +## PAC bypass via RPAC path (CVE-2025-31201) |
| 53 | + |
| 54 | +arm64e Pointer Authentication (PAC) impedes hijacking of return addresses and function pointers. The chain reports defeating PAC using an RPAC path once arbitrary read/write is available. |
| 55 | + |
| 56 | +Key idea: |
| 57 | +- With arbitrary R/W, attackers can craft valid, re-signed pointers or pivot execution to PAC-tolerant paths. The so-called “RPAC path” enables control-flow under PAC constraints, turning a userland RCE into a reliable kernel exploit setup. |
| 58 | + |
| 59 | +Notes for researchers: |
| 60 | +- Collect info leaks to defeat KASLR and stabilize ROP/JOP chains even under PAC. |
| 61 | +- Target callsites that generate or authenticate PAC in controllable ways (e.g., signatures generated on attacker-controlled values, predictable context keys, or gadget sequences that re-sign pointers). |
| 62 | +- Expect Apple hardening variance by SoC/OS; reliability hinges on leaks, entropy, and robust primitives. |
| 63 | + |
| 64 | +## Kernel escalation: wireless/AMPDU path example |
| 65 | + |
| 66 | +In the observed chain, once in userland with memory corruption and a PAC bypass primitive, kernel control was achieved via code paths in the Wi‑Fi stack (AppleBCMWLAN) under malformed AMPDU handling. Example logs: |
| 67 | + |
| 68 | +```text |
| 69 | +IO80211ControllerMonitor::setAMPDUstat unhandled kAMPDUStat_ type 14 |
| 70 | +IO80211ControllerMonitor::setAMPDUstat unhandled kAMPDUStat_ type 13 |
| 71 | +``` |
| 72 | + |
| 73 | +General technique: |
| 74 | +- Use userland primitives to build kernel R/W or controlled call paths. |
| 75 | +- Abuse reachable kernel surfaces (IOKit, networking/AMPDU, media shared memory, Mach interfaces) to achieve kernel PC control or arbitrary memory. |
| 76 | +- Stabilize by building read/write primitives and defeating PPL/SPTM constraints where applicable. |
| 77 | + |
| 78 | +## Post-exploitation: CryptoTokenKit and identity/signing abuse |
| 79 | + |
| 80 | +Once kernel is compromised, processes like identityservicesd can be impersonated and privileged cryptographic operations invoked via CryptoTokenKit without user prompts. Example logs: |
| 81 | + |
| 82 | +```text |
| 83 | +CryptoTokenKit operation:2 algo:algid:sign:ECDSA:digest-X962:SHA256 |
| 84 | +CryptoTokenKit <sepk:p256(d) kid=9a86778f7163e305> parsed for identityservicesd |
| 85 | +``` |
| 86 | + |
| 87 | +Impact: |
| 88 | +- Use Secure Enclave–backed keys for unauthorized signing (tokens, messages, payments), breaking trust models even if keys are not exported. |
| 89 | +- Intercept 2FA codes/messages silently; authorize payments/transfers; enable stealth mic/camera/GPS. |
| 90 | + |
| 91 | +Defensive angle: |
| 92 | +- Treat post-kernel integrity breaks as catastrophic: enforce runtime attestation for CTK consumers; minimize ambient authority; verify entitlements at the point of use. |
| 93 | + |
| 94 | +## Reproduction and telemetry hints (lab only) |
| 95 | + |
| 96 | +- Delivery: send a crafted AMR/MP4-AAC audio to the target device via iMessage/SMS. |
| 97 | +- Observe telemetry for the foregoing log lines around parsing and wireless stack reactions. |
| 98 | +- Ensure devices are fully patched; only test in isolated lab setups. |
| 99 | + |
| 100 | +## Mitigations and hardening ideas |
| 101 | + |
| 102 | +- Patch level: iOS 18.4.1 reportedly fixes this chain; keep devices up to date. |
| 103 | +- Parser hardening: strict validation for codec cookies/atoms and lengths; defensive decoding paths with bounds checks. |
| 104 | +- iMessage isolation: avoid relaxing BlastDoor/Blackhole in “known sender” contexts for media parsing. |
| 105 | +- PAC hardening: reduce PAC-gadget availability; ensure signatures are bound to unpredictable contexts; remove PAC-tolerant bypassable patterns. |
| 106 | +- CryptoTokenKit: require post-kernel attestation and strong entitlements at call-time for key-bound operations. |
| 107 | +- Kernel surfaces: harden wireless AMPDU/status handling; minimize attacker-controlled inputs from userland after compromise. |
| 108 | + |
| 109 | +## Affected versions (as reported) |
| 110 | + |
| 111 | +- iOS 18.x prior to iOS 18.4.1 (April 16, 2025). |
| 112 | +- Primary: CoreAudio → AudioConverterService (media auto-parsing path via iMessage/SMS). |
| 113 | +- Chained: PAC/RPAC path and kernel escalation via AppleBCMWLAN AMPDU handling. |
| 114 | + |
| 115 | +## References |
| 116 | + |
| 117 | +- [iOS Crypto Heist repo (README)](https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201) |
| 118 | +- [Remote Crypto Attack Chain details](https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md) |
| 119 | + |
| 120 | +{{#include ../../banners/hacktricks-training.md}} |
0 commit comments